FGESPC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FGESPC.exe
Size

8.4MB
MD5

51e2d3c124aff78d835b1279586924e6
SHA1

1a31941ec35d629d6bc644ae21e5c46d635f1d71
SHA256

d240d91a8aae76e618ee60712e5405d18d940e72645e15b5f3d4a97204fba573
SHA512

bad3167de3b6184d0f9b02158a166a2a653a01018771852d4df36b972247cb5bcd9a96c1f7b7011580965cd0ae5b812cf8e0f0b0b1e7fc2d2d7cf6f6b839f772
SSDEEP

196608:pWW2XEoHnTXqibWvnyZYTJ3dk5Y0G5jBwcWm8u+FGH+uX1:85D4fTTJ5nJBY9tBe1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FGESPC.exe

Files

FGESPC.exe
.exe windows:6 windows x64 arch:x64

5ce7a40a5d83ca2282e2610121dfedfe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueW

kernel32

GetModuleHandleA

shell32

DragFinish

user32

MessageBoxA

Sections

Size: - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE